diff --git a/core/utils.go b/core/utils.go
index bb54112..5f6dbeb 100644
--- a/core/utils.go
+++ b/core/utils.go
@@ -220,7 +220,7 @@ func GetMagicDNSSuffixFromStatus(st *ipnstate.Status) (string, error) {
 	return suffix, nil
 }
 
-func NormalizeDstAddrWithSuffix(dst string) (string, bool, error) {
+func NormalizeDstAddrWithSuffix(ctx context.Context, srv *tsnet.Server, dst string) (string, bool, error) {
 	host, port, err := net.SplitHostPort(dst)
 	if err != nil {
 		return dst, false, err
@@ -230,24 +230,29 @@ func NormalizeDstAddrWithSuffix(dst string) (string, bool, error) {
 		return dst, false, nil
 	}
 
-	if strings.Contains(host, ".") {
-		return dst, false, nil
-	}
-
 	suffix, ok := GetMagicDNSSuffix()
 	if !ok {
 		return dst, false, nil
 	}
 
 	normalized := net.JoinHostPort(host+"."+suffix, port)
+
+	// check domain exists before use
+	if strings.Contains(host, ".") {
+		_, err = resolveAddr(ctx, srv, normalized)
+		if err != nil {
+			return dst, false, nil
+		}
+	}
+
 	return normalized, true, nil
 }
 
-func NormalizeConnectRulesDstAddr(rules map[string][]ConnectRule, logger *slog.Logger) {
+func NormalizeConnectRulesDstAddr(ctx context.Context, srv *tsnet.Server, rules map[string][]ConnectRule, logger *slog.Logger) {
 	for tag, rrs := range rules {
 		for i := range rrs {
 			rule := &rrs[i]
-			normalized, changed, err := NormalizeDstAddrWithSuffix(rule.DstAddr)
+			normalized, changed, err := NormalizeDstAddrWithSuffix(ctx, srv, rule.DstAddr)
 			if err != nil {
 				logger.Debug("failed to normalize dst_addr",
 					slog.String("tag", tag),
diff --git a/main.go b/main.go
index 14c00d8..0045d14 100644
--- a/main.go
+++ b/main.go
@@ -43,7 +43,7 @@ func serviceLogic(configPath string, isTsnetDebug bool, configURL string, logger
 	}
 	logger.Info("tsnet server initialized")
 
-	core.NormalizeConnectRulesDstAddr(cfg.Connect, logger)
+	core.NormalizeConnectRulesDstAddr(ctx, srv, cfg.Connect, logger)
 
 	core.StartForwarders(ctx, srv, cfg.Forward)
 	core.StartConnectors(ctx, srv, cfg.Connect)